CVE-2026-99155

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99155", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:09.733Z", "dateUpdated": "2026-10-30T12:42:21.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:21.472Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated. Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed. The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/xen-scsifront.c"], "versions": [{"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "lessThan": "448b9a8b530b753d346dab10add09a502fc719a4", "status": "affected", "versionType": "git"}, {"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "lessThan": "e397d4da76bed72db6ac4a0848fb6217f8394dca", "status": "affected", "versionType": "git"}, {"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "lessThan": "90186a2354821329a27d92b266c0f05e8f4f637c", "status": "affected", "versionType": "git"}, {"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "lessThan": "1d91ec793d6c80eca963d426e0da832d40a062df", "status": "affected", "versionType": "git"}, {"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "lessThan": "15791e57f57f7050014d08cfe239d4aa1e6b94b0", "status": "affected", "versionType": "git"}, {"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "lessThan": "8c8222c255772713eb36cde695777a1fce224917", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/xen-scsifront.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/448b9a8b530b753d346dab10add09a502fc719a4"}, {"url": "https://git.kernel.org/stable/c/e397d4da76bed72db6ac4a0848fb6217f8394dca"}, {"url": "https://git.kernel.org/stable/c/90186a2354821329a27d92b266c0f05e8f4f637c"}, {"url": "https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df"}, {"url": "https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0"}, {"url": "https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"}], "title": "scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/xen-scsifront.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "448b9a8b530b753d346dab10add09a502fc719a4", "status": "affected", "version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "versionType": "git"}, {"lessThan": "e397d4da76bed72db6ac4a0848fb6217f8394dca", "status": "affected", "version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "versionType": "git"}, {"lessThan": "90186a2354821329a27d92b266c0f05e8f4f637c", "status": "affected", "version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "versionType": "git"}, {"lessThan": "1d91ec793d6c80eca963d426e0da832d40a062df", "status": "affected", "version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "versionType": "git"}, {"lessThan": "15791e57f57f7050014d08cfe239d4aa1e6b94b0", "status": "affected", "version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "versionType": "git"}, {"lessThan": "8c8222c255772713eb36cde695777a1fce224917", "status": "affected", "version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/xen-scsifront.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated. Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed. The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated."}], "id": "CVE-2026-99155", "lastModified": "2026-10-30T13:21:49.287", "metrics": {}, "published": "2026-10-28T11:17:35.687", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/448b9a8b530b753d346dab10add09a502fc719a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90186a2354821329a27d92b266c0f05e8f4f637c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e397d4da76bed72db6ac4a0848fb6217f8394dca"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: xen-scsifront: Denial of Service via NULL pointer dereference", "id": "2562717", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562717"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated. Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed. The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\nReject a response whose shadow slot is not populated.", "A flaw was found in the Linux kernel's Xen virtual Small Computer System Interface (SCSI) frontend driver. This vulnerability allows a malicious or compromised backend service to trigger a Denial of Service (DoS) by crashing the guest virtual machine. The issue occurs when the driver processes a storage response referencing an inactive request identifier, causing the system to dereference an unpopulated pointer due to missing validation."], "name": "CVE-2026-99155", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99155\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99155\nhttps://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0\nhttps://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df\nhttps://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"], "statement": "This vulnerability is classified as having Moderate severity because exploitation requires elevated host privileges or a compromised Xen backend domain, restricting exposure exclusively to Xen-virtualized guests using virtual SCSI devices. In standard Red Hat Enterprise Linux environments, virtualization primarily utilizes KVM with virtio storage rather than Xen paravirtualized SCSI drivers. Furthermore, triggering the unpopulated pointer dereference results only in a guest denial of service without permitting arbitrary code execution or data leakage.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43,1d91ec793d6c80eca963d426e0da832d40a062df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43,15791e57f57f7050014d08cfe239d4aa1e6b94b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43,8c8222c255772713eb36cde695777a1fce224917)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43,1d91ec793d6c80eca963d426e0da832d40a062df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43,15791e57f57f7050014d08cfe239d4aa1e6b94b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43,8c8222c255772713eb36cde695777a1fce224917)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:15:14.880549+00:00", "updated": "2026-11-02T02:00:09.133481+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}